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IN THE CLAIMS 

1. (Previously Presented) Apparatus for providing decision support to an analyst in 
accordance with an event management system which manages a network with one or more 
computing devices, the apparatus comprising: 

at least one processor operative to perform: (i) an automated off-line analysis of data 
representing past events associated with the network of computing devices being managed by the 
event management system, the automated analysis comprising generation of one or more 
visualizations of one or more portions of the past event data and discovery of one or more patterns in 
the past event data; and (ii) automated rule off-line management comprising construction and 
validation of one or more rules formed in accordance with the automated off-line analysis of the past 
event data, wherein one or more rules are constructed offline and validated offline based directly on 
at least a portion of the one or more visualizations generated offline from the corresponding offline 
analysis of the one or more portions of the past event data and the offline discovery of at least a 
portion of the one or more patterns in the past event data; and 

memory, coupled to the at least one processor, which stores at least a portion of results 
associated with the automated off-line event analysis and off-line rule management operations. 

2. (Original) The apparatus of claim 1 , wherein the past event data is obtained from an event 
database and the one or more rules are provided to a rule database, the event database and the rule 
database being associated with an execution system of the event management system. 

3. (Original) The apparatus of claim 2, wherein generation of the one or more visualizations 
of the one or more portions of the past event data further comprises: 

selecting a subset of the past event data from the event database; 
generating a visualization of the subset of past event data using a visualization tool; 
the analyst reviewing the visualization to determine whether there are any groupings of 
events that are of interest presented therein; and 

performing an appropriate action when an event grouping of interest is found. 
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4. (Original) The apparatus of claim 2, wherein discovery of the one or more patterns in the 
past event data further comprises: 

selecting a subset of the past event data from the event database; 

mining the subset of the past event data to discover the one or more patterns using a mining 

tool; 

generating a visualization of the one or more patterns using a visualization tool; 
the analyst reviewing the visualization to determine whether there are any patterns of interest 
presented therein; and 

performing an appropriate action when a pattern of interest is found. 

5. (Original) The apparatus of claim 2, wherein vaUdation of the one or more rules further 
comprises: 

selecting a subset of the past event data from the event database; 

finding one or more instances of patterns expressed in terms of left-hand sides of rules; 

generating a visualization of the one or more pattern instances using a visualization tool; 

analyzing the left-hand sides of rules using a rule validation tool; 

displaying results of the analysis operation; 

the analyst assessing analysis results; and 

marking the rules as one of validated and not validated based on the assessment by the 

analyst. 

6. (Original) The apparatus of claim 2, wherein construction of the one or more rules ftirther 
comprises: 

selecting a subset of the past event data from the event database; 

mining the subset of the past event data to discover the one or more patterns using a mining 

tool; 

assessing significance of the one or more patterns using a visuahzation tool; 
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constructing the one or more rules from a selected subset of the one or more patterns using a 
rule construction tool; and 

writing the one or more rules in the rule database. 

7. (Previously Presented) A computer-based method of providing decision support to an 
analyst in accordance with an event management system which manages a network with one or more 
computing devices, the method comprising the steps of: 

automatically analyzing, off-line, data representing past events associated with the network of 
computing devices being managed by the event management system, the automated off-line analysis 
comprising generation of one or more visualizations of one or more portions of the past event data 
and discovery of one or more patterns in the past event data; and 

automatically managing rules off-line, the automated off-Une rule management comprising 
construction and validation of one or more rules formed in accordance with the automated off-line 
analysis of the past event data, wherein one or more rules are constructed offline and validated 
offline based directly on at least a portion of the one or more visualizations generated offline from 
the corresponding offline analysis of the one or more portions of the past event data and the offline 
discovery of at least a portion of the one or more patterns in the past event data. 

8. (Original) The method of claim 7, wherein the past event data is obtained from an event 
database and the one or more rules are provided to a rule database, the event database and the rule 
database being associated with an execution system of the event management system. 

9. (Original) The method of claim 7, wherein generation of the one ormore visualizations of 
the one or more portions of the past event data further comprises: 

selecting a subset of the past event data from the event database; 
generating a visualization of the subset of past event data using a visualization tool; 
the analyst reviewing the visualization to determine whether there are any groupings of 
events that are of interest presented therein; and 
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performing an appropriate action when an event grouping of interest is found. 

10. (Original) The method of claim 7, wherein discovery of the one or more patterns in the 
past event data further comprises: 

selecting a subset of the past event data from the event database; 

mining the subset of the past event data to discover the one or more patterns using a mining 

tool; 

generating a visualization of the one or more patterns using a visualization tool; 
the analyst reviewing the visualization to determine whether there are any patterns of interest 
presented therein; and 

performing an appropriate action when a pattern of interest is found. 

11. (Original) The method of claim 7, wherein validation of the one or more rules further 
comprises: 

selecting a subset of the past event data from the event database; 

finding one or more instances of patterns expressed in terms of left-hand sides of rules; 

generating a visualization of the one or more pattern instances using a visualization tool; 

analyzing the left-hand sides of rules using a rule vahdation tool; 

displaying results of the analysis operation; 

the analyst assessing analysis results; and 

marking the rules as one of validated and not validated based on the assessment by the 

analyst. 

12. (Original) The method of claim 7, wherein construction of the one or more rules further 
comprises: 

selecting a subset of the past event data from the event database; 

mining the subset of the past event data to discover the one or more patterns using a mining 

tool; 
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assessing significance of the one or more patterns using a visualization tool; 
constructing the one or more rules from a selected subset of the one or more patterns using a 
rule construction tool; and 

writing the one or more rules in the rule database. 

13. (Previously Presented) An article of manufacture for providing decision support to an 
analyst in accordance with an event management system which manages a network with one or more 
computing devices, the article comprising a machine readable medium containing one or more 
programs which when executed implement the steps of: 

automatically analyzing data, off-line, representing past events associated with the network of 
computing devices being managed by the event management system, the automated off-line analysis 
comprising generation of one or more visualizations of one or more portions of the past event data 
and discovery of one or more patterns in the past event data; and 

automatically managing rules off-line, the automated off-line rule management comprising 
construction and validation of one or more rules formed in accordance with the automated off-line 
analysis of the past event data, wherein one or more rules are constructed offline and validated 
offline based directly on at least a portion of the one or more visualizations generated offline from 
the corresponding offline analysis of the one or more portions of the past event data and the offline 
discovery of at least a portion of the one or more patterns in the past event data. 

14. (Original) The article of claim 13, wherein the past event data is obtained from an event 
database and the one or more rules are provided to a rule database, the event database and the rule 
database being associated with an execution system of the event management system. 

15. (Previously Presented) Apparatus for providing decision support to an analyst in 
accordance with an event management system which manages a network with one or more 
computing devices, the apparatus comprising: 
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first processing means for performing an automated off-line analysis of data representing past 
events associated with the network of computing devices being managed by the event management 
system, the automated off-line analysis comprising generation of one or more visualizations of one or 
more portions of the past event data and discovery of one or more patterns in the past event data; 

second processing means for performing automated off-line rule management comprising 
construction and validation of one or more rules formed in accordance with the automated off-line 
analysis of the past event data, wherein one or more rules are constructed offline and validated 
offline based directly on at least a portion of the one or more visualizations generated offline from 
the corresponding offline analysis of the one or more portions of the past event data and the offline 
discovery of at least a portion of the one or more patterns in the past event data; and 

memory means, coupled to the first and second processing means, for storing at least a 
portion of results associated with the automated off-line event analysis and offline rule management 
operations. 

16. (Original) The apparatus of claim 15, wherein the past event data is obtained fi:om an 
event database and the one or more rules are provided to a rule database, the event database and the 
rule database being associated with an execution system of the event management system. 

17. (Previously Presented) An event management decision support system for providing 
decision support to an analyst in accordance with an event management system which manages a 
network with one or more computing devices, the system comprising: 

one or more data analysis tools for automatically analyzing, in an off-line condition, data 
representing events associated with the network of computing devices being managed by the event 
management system, the automated analysis comprising generation of one or more visualizations of 
one or more portions of the event data and discovery of one or more patterns in the event data; and 
one or more rule management tools for automatically managing rules in an off-line condition, the 
automated rule management comprising construction and validation of one or more rules formed in 
accordance with the automated analysis of the event data, wherein one or more rules are constructed 
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offline and validated offline based directly on at least a portion of the one or more visualizations 
generated offline from the corresponding offline analysis of the one or more portions of the event 
data and the offline discovery of at least a portion of the one or more patterns in the event data. 

18. (Original) The system of claim 17, wherein the event data is obtained from an event 
database and the one or more rules are provided to a rule database, the event database and the rule 
database being associated with an execution system of the event management system. 

19. (Previously Presented) An event management decision support system for providing 
decision support to an event management system which manages a network with one or more 
computing devices, the system comprising: 

an event analysis module, further comprising an event mining module and an event 
visualization module, wherein the event mining module discovers patterns in event data, and wherein 
the event visualization module provides a mechanism for visualizing at least a result of a pattern 
discovery and a rule analysis; and 

a rule management module, further comprising a rule validation module and a rule 
construction module, wherein the rule validation module maintains consistency of at least a rule with 
the event data, and wherein the rule construction module provides a mechanism for constructing one 
or more rules based on event patterns mined by the event mining module; 

wherein the one or more rules are constructed offline by the rule construction module and 
validated offline by the rule vahdation module based directly on at least a portion of the one or more 
visualizations generated offline by the event visualization module from the corresponding offline 
analysis of the one or more portions of the event data and the offline discovery of at least a portion of 
the one or more patterns in the event data by the event mining module. 
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